Greetings.
I've been trying to build a correlation search that sets a default disposition value when it runs but so far it doesnt work as advertised. I've tried this one of two ways:
1) manually setting it to a valid value e.g.
| eval disposition="disposition:7"
| eval disposition_label="My cool disposition label"
2) by editing the correlation search in the advanced search editor and setting the parameter myself:
I've tried this with and without quotes, but I still always get a disposition:6 set by default.
I have validated that this disposition and label does exist and is enabled in Incident Review settings, and can manually be set.
Can someone shine some light on what I'm doing wrong?
Many thanks!
